In the section "Configure SharePoint on-premises Single Sign-On", the script to create the new SPTrustedIdentityTokenIssuer, should have an additional mapping to support security groups. The following worked for me:
$map5 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Group" -SameAsIncoming
Adding this mapping allows group lookups through AzureCP.
⚠Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.
@joshtransient Thanks for the feedback! We are currently investigating and will update you shortly.
@joshtransient Thanks for the feedback ! I have assigned this issue to content author to investigate and update the document as appropriate.
Code in the example looks like it was updated to add $map5, but last line does not add $map5 in the -ClaimsMapping argument.
@chetansriv Yes we missed it in the last line for adding the map5 variable. So please add that here.
@joshtransient This is complete now, please review